Add support for passing Secret ID as CredentialSpec

Adds support for passing a secret ID as the CredentialSpec source. Also
lays the groundwork for future uses of Secrets in places other than
mounted into the container.

Signed-off-by: Drew Erny <drew.erny@docker.com>

api/api.pb.txt

@@ -3817,6 +3817,34 @@ file {
       json_name: "mode"
     }
   }
+  message_type {
+    name: "RuntimeTarget"
+    field {
+      name: "used_as"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_ENUM
+      type_name: ".docker.swarmkit.v1.RuntimeTarget.Use"
+      json_name: "usedAs"
+    }
+    enum_type {
+      name: "Use"
+      value {
+        name: "UNKNOWN"
+        number: 0
+        options {
+          66001: "Unknown"
+        }
+      }
+      value {
+        name: "CREDENTIALSPEC"
+        number: 1
+        options {
+          66001: "CredentialSpec"
+        }
+      }
+    }
+  }
   message_type {
     name: "SecretReference"
     field {
@@ -3842,6 +3870,15 @@ file {
       oneof_index: 0
       json_name: "file"
     }
+    field {
+      name: "runtime"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".docker.swarmkit.v1.RuntimeTarget"
+      oneof_index: 0
+      json_name: "runtime"
+    }
     oneof_decl {
       name: "target"
     }
@@ -4048,6 +4085,14 @@ file {
         oneof_index: 0
         json_name: "registry"
       }
+      field {
+        name: "secret"
+        number: 3
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        oneof_index: 0
+        json_name: "secret"
+      }
       oneof_decl {
         name: "source"
       }